managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/define-deep-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-deep-agent.d.ts","sourceRoot":"","sources":["../src/define-deep-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EAEtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,OAAO,SAAS,qBAAqB,EACzE,MAAM,EAAE,OAAO,GACd,mBAAmB,CAAC,OAAO,CAAC,CA8C9B"}
+{"version":3,"file":"define-deep-agent.d.ts","sourceRoot":"","sources":["../src/define-deep-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EAEtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,OAAO,SAAS,qBAAqB,EACzE,MAAM,EAAE,OAAO,GACd,mBAAmB,CAAC,OAAO,CAAC,CAoD9B"}

package/dist/define-deep-agent.js

@@ -44,9 +44,15 @@ export function defineDeepAgent(config) {
             "Write your agent's system prompt in instructions.md next to agent.ts; " +
             "the CLI embeds it at deploy time.");
     }
-    if ("disableMemory" in provided &&
-        typeof provided.disableMemory !== "boolean") {
-        throw new Error("disableMemory must be a boolean");
+    // Memory is no longer a knob on the agent definition: it is declared once, in
+    // `memory.ts`. Rejecting the old flag outright (rather than treating it as a
+    // redundant "off") keeps `disableMemory: false` from silently meaning the
+    // opposite of what it used to.
+    if ("disableMemory" in provided) {
+        throw new Error("disableMemory is no longer supported in defineDeepAgent(...). Durable " +
+            "memory is opt-in and declared in memory.ts: export `memory` with " +
+            '`defineMemory({ scope: "agent" })` to enable it, or leave the file out ' +
+            "to keep no memory (the default). Remove `disableMemory` here.");
     }
     const managed = ["backend", "store", "checkpointer", "memory", "skills"].filter((key) => key in provided);
     if (managed.length > 0) {

package/dist/define-deep-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"define-deep-agent.js","sourceRoot":"","sources":["../src/define-deep-agent.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAe;IAEf,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAiC,CAAC;IAEnD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,kEAAkE;YAClE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,wEAAwE;YACxE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IAED,IACE,eAAe,IAAI,QAAQ;QAC3B,OAAO,QAAQ,CAAC,aAAa,KAAK,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GACX,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CACxD,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAA0B,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB;YAC1E,2EAA2E;YAC3E,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM;KACyB,CAAC;AACpC,CAAC"}
+{"version":3,"file":"define-deep-agent.js","sourceRoot":"","sources":["../src/define-deep-agent.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAe;IAEf,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAiC,CAAC;IAEnD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,kEAAkE;YAClE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,wEAAwE;YACxE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,+BAA+B;IAC/B,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,mEAAmE;YACnE,yEAAyE;YACzE,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CACxD,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAA0B,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB;YAC1E,2EAA2E;YAC3E,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM;KACyB,CAAC;AACpC,CAAC"}

package/dist/extension.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The contribution API behind the extensible MDA primitives.
+ *
+ * `defineExtension(kind, options)` returns the factory a connector namespace
+ * calls, such as `connectors.slack({ … })`. Argument parsing, branding, and
+ * manifest stamping are shared.
+ *
+ * Every kind declares its input through `args`, which takes a schema from any
+ * [Standard Schema](https://standardschema.dev) library — Zod, Valibot,
+ * ArkType — or a plain function where a schema does not fit. Validating through
+ * that interface keeps the vendor out of this package's dependencies, so a
+ * contributor picks whichever library they already use.
+ *
+ * This module is deliberately absent from the package barrel. Only the
+ * first-party namespaces in `namespaces.ts` contribute primitives, so an agent
+ * project cannot mount its own adapter or HTTP route into the managed runtime.
+ * Opening it up to third-party packages is a later step.
+ *
+ * The `auth`, `credentials`, and `connect` primitives are extended by plain
+ * factories rather than through here: they return inert configuration objects
+ * with no brand, hooks, or normalization to share. They gain an envelope when
+ * this API is exported and their inputs need validating at the boundary.
+ */
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { ChannelTransport } from "./channels/runtime.js";
+import { type Connector, type ConnectorRequirements, type ConnectorToolList, type EventsContext, type HttpContext, type SandboxContext, type ToolContext } from "./runtime/connector.js";
+/** The primitives that carry a shared construction envelope. */
+export type ExtensionKind = "connector";
+/**
+ * How author input becomes the arguments a primitive is built from.
+ *
+ * Either a schema from any [Standard Schema](https://standardschema.dev)
+ * library — Zod, Valibot, ArkType, … — or a plain function for the cases a
+ * schema cannot express. Both run at module load, so misconfiguration surfaces
+ * at build or dev startup rather than mid-run. Defaults and coercions belong
+ * here too: whatever this produces is what the primitive carries.
+ */
+export type ExtensionArgs<TInput, TArgs> = StandardSchemaV1<TInput, TArgs> | ((input: TInput) => TArgs);
+/** Shared by every kind: how the factory's input is validated, and its name. */
+interface ExtensionEnvelope<TInput, TArgs> {
+    args: ExtensionArgs<TInput, TArgs>;
+    /**
+     * How the factory is spelled in an agent project, e.g. `"connectors.mcp"`.
+     * Prefixes validation errors, which is the only place an author sees it.
+     */
+    label: string;
+}
+/**
+ * A connector contributes tools, HTTP routes, sandbox provisioning, inbound
+ * events, and/or a named messaging surface. Hooks receive the built connector,
+ * so they can read the parsed arguments spread onto it.
+ */
+export interface ConnectorExtensionOptions<TInput, TArgs extends object, TKind extends string> extends ExtensionEnvelope<TInput, TArgs> {
+    /** Diagnostic label (e.g. `"mcp_servers"`). Mounts use the file-stem name. */
+    kind: TKind;
+    tools?(ctx: ToolContext, self: ConnectorInstance<TArgs, TKind>): ConnectorToolList | Promise<ConnectorToolList>;
+    http?(ctx: HttpContext, self: ConnectorInstance<TArgs, TKind>): void | Promise<void>;
+    sandbox?(ctx: SandboxContext, self: ConnectorInstance<TArgs, TKind>): void | Promise<void>;
+    events?(ctx: EventsContext, self: ConnectorInstance<TArgs, TKind>): Response | Promise<Response>;
+    messaging?(env: NodeJS.ProcessEnv, self: ConnectorInstance<TArgs, TKind>): ChannelTransport | undefined;
+    requirements?(name: string, self: ConnectorInstance<TArgs, TKind>): ConnectorRequirements;
+}
+/** The connector a `"connector"` extension builds: its brand, kind, and args. */
+export type ConnectorInstance<TArgs extends object, TKind extends string> = Connector & TArgs & {
+    readonly kind: TKind;
+};
+export declare function defineExtension<TInput, TArgs extends object, TKind extends string>(kind: "connector", options: ConnectorExtensionOptions<TInput, TArgs, TKind>): (input: TInput) => ConnectorInstance<TArgs, TKind>;
+export {};
+//# sourceMappingURL=extension.d.ts.map

package/dist/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAEhC,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,IACnC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,GAC/B,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC;AAE/B,gFAAgF;AAChF,UAAU,iBAAiB,CAAC,MAAM,EAAE,KAAK;IACvC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB,CACxC,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,CACpB,SAAQ,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;IACxC,8EAA8E;IAC9E,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,CACJ,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,CAAC,CACH,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CACN,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,CACL,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,SAAS,CAAC,CACR,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,gBAAgB,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,qBAAqB,CAAC;CAC1B;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,CAC3B,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,IAClB,SAAS,GAAG,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEjD,wBAAgB,eAAe,CAC7B,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,EAEpB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GACvD,CAAC,KAAK,EAAE,MAAM,KAAK,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC"}

package/dist/extension.js

@@ -0,0 +1,108 @@
+/**
+ * The contribution API behind the extensible MDA primitives.
+ *
+ * `defineExtension(kind, options)` returns the factory a connector namespace
+ * calls, such as `connectors.slack({ … })`. Argument parsing, branding, and
+ * manifest stamping are shared.
+ *
+ * Every kind declares its input through `args`, which takes a schema from any
+ * [Standard Schema](https://standardschema.dev) library — Zod, Valibot,
+ * ArkType — or a plain function where a schema does not fit. Validating through
+ * that interface keeps the vendor out of this package's dependencies, so a
+ * contributor picks whichever library they already use.
+ *
+ * This module is deliberately absent from the package barrel. Only the
+ * first-party namespaces in `namespaces.ts` contribute primitives, so an agent
+ * project cannot mount its own adapter or HTTP route into the managed runtime.
+ * Opening it up to third-party packages is a later step.
+ *
+ * The `auth`, `credentials`, and `connect` primitives are extended by plain
+ * factories rather than through here: they return inert configuration objects
+ * with no brand, hooks, or normalization to share. They gain an envelope when
+ * this API is exported and their inputs need validating at the boundary.
+ */
+import { CONNECTOR_BRAND, } from "./runtime/connector.js";
+export function defineExtension(kind, options) {
+    switch (kind) {
+        case "connector":
+            return connectorExtension(options);
+        default:
+            throw new TypeError(`Unknown extension kind: ${String(kind)}`);
+    }
+}
+function connectorExtension(options) {
+    const parse = parser(options);
+    return (input) => {
+        const args = parse(input);
+        const self = { kind: options.kind, ...args };
+        // Hooks and the brand stay non-enumerable so a connector still spreads and
+        // serializes as its plain configuration.
+        hide(self, CONNECTOR_BRAND, true);
+        if (options.tools) {
+            const tools = options.tools;
+            hide(self, "tools", (ctx) => tools(ctx, self));
+        }
+        if (options.http) {
+            const http = options.http;
+            hide(self, "http", (ctx) => http(ctx, self));
+        }
+        if (options.sandbox) {
+            const sandbox = options.sandbox;
+            hide(self, "sandbox", (ctx) => sandbox(ctx, self));
+        }
+        if (options.events) {
+            const events = options.events;
+            hide(self, "events", (ctx) => events(ctx, self));
+        }
+        if (options.messaging) {
+            const messaging = options.messaging;
+            hide(self, "messaging", (env) => messaging(env, self));
+        }
+        if (options.requirements) {
+            const requirements = options.requirements;
+            hide(self, "requirements", (name) => requirements(name, self));
+        }
+        return self;
+    };
+}
+/**
+ * Resolve `args` into the function the factory runs on its input.
+ *
+ * A schema is validated through the Standard Schema interface, so the vendor
+ * (Zod, Valibot, …) never has to be a dependency of this package.
+ */
+function parser(options) {
+    const { args, label } = options;
+    if (typeof args === "function") {
+        return args;
+    }
+    const { validate } = args["~standard"];
+    return (input) => {
+        const result = validate(input);
+        if (result instanceof Promise) {
+            throw new TypeError(`${label}(...) needs a schema that validates synchronously, because ` +
+                "primitives are declared at module load. Drop the async refinement " +
+                "or validate inside a hook instead.");
+        }
+        if (result.issues) {
+            throw new Error(`${label}(...) ${describeIssues(result.issues)}`);
+        }
+        return result.value;
+    };
+}
+/** Render schema issues as `path: message`, in the order the vendor reported. */
+function describeIssues(issues) {
+    const lines = issues.map((issue) => {
+        const path = (issue.path ?? [])
+            .map((segment) => String(typeof segment === "object" ? segment.key : segment))
+            .join(".");
+        return path.length > 0 ? `${path}: ${issue.message}` : issue.message;
+    });
+    return lines.length === 1
+        ? `received invalid configuration — ${lines[0]}.`
+        : `received invalid configuration:\n  - ${lines.join("\n  - ")}`;
+}
+function hide(target, key, value) {
+    Object.defineProperty(target, key, { value, enumerable: false });
+}
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EACL,eAAe,GAQhB,MAAM,wBAAwB,CAAC;AAgFhC,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,OAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC;YACE,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAwD;IAExD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAGzC,CAAC;QACF,2EAA2E;QAC3E,yCAAyC;QACzC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,OAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,GAAG,KAAK,6DAA6D;gBACnE,oEAAoE;gBACpE,oCAAoC,CACvC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,MAAyC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,MAAM,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5D;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,oCAAoC,KAAK,CAAC,CAAC,CAAC,GAAG;QACjD,CAAC,CAAC,wCAAwC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,GAAoB,EAAE,KAAc;IAChE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/identity/actor-subject.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export declare const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+export interface AgentIdFromActorOptions {
+    /**
+     * Workspace discriminator so ids do not collide across workspaces.
+     * Defaults to {@link resolveActorDeploymentId} (`LANGSMITH_WORKSPACE_ID`).
+     */
+    deploymentId?: string;
+    /** Override process env (tests). */
+    env?: NodeJS.ProcessEnv;
+    /** Override the UUID namespace (tests). */
+    namespace?: string;
+}
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGSMITH_WORKSPACE_ID`, else `"local"`.
+ */
+export declare function resolveActorDeploymentId(env?: NodeJS.ProcessEnv): string;
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export declare function agentIdFromActor(userId: string, options?: AgentIdFromActorOptions): string;
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export declare function enableActorSubjectIntegration(integrationId: string): void;
+/** True when actor-subject routing is on for `integrationId`. */
+export declare function isActorSubjectIntegrationEnabled(integrationId: string): boolean;
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export declare function isActorSubjectSlugEnabled(slug: string | undefined): boolean;
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export declare function enabledActorSubjectIntegrations(): readonly string[];
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export declare function enableActorSubjectIntegrationsFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export declare function enableActorSubjectIntegrationFromConnectors(integration: FleetOAuthIntegration, connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Test-only reset. */
+export declare function resetActorSubjectEnabledForTests(): void;
+//# sourceMappingURL=actor-subject.d.ts.map

package/dist/identity/actor-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.d.ts","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAY/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAUR;AAKD,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED,iEAAiE;AACjE,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,mEAAmE;AACnE,wBAAgB,+BAA+B,IAAI,SAAS,MAAM,EAAE,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CAC1D,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAcN;AAED,iFAAiF;AACjF,wBAAgB,2CAA2C,CACzD,WAAW,EAAE,qBAAqB,EAClC,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAON;AAED,uBAAuB;AACvB,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/identity/actor-subject.js

@@ -0,0 +1,107 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { v5 as uuidv5 } from "uuid";
+import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../connectors/marketplace/catalog.js";
+import { FLEET_OAUTH_INTEGRATIONS, integrationForSlug, hasIntegrationToolServerConnector, } from "../connectors/toolserver/integrations.js";
+function isUserScoped(scope) {
+    if (!scope) {
+        return false;
+    }
+    // Per-caller Connect / actor-subject vault ownership. Memory is unrelated.
+    return scope.credentials === "user" || scope.credentials === "custom";
+}
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGSMITH_WORKSPACE_ID`, else `"local"`.
+ */
+export function resolveActorDeploymentId(env = process.env) {
+    return trimmed(env.LANGSMITH_WORKSPACE_ID) ?? "local";
+}
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export function agentIdFromActor(userId, options = {}) {
+    const id = userId.trim();
+    if (!id) {
+        throw new Error("agentIdFromActor requires a non-empty userId");
+    }
+    const deploymentId = options.deploymentId?.trim() ||
+        resolveActorDeploymentId(options.env ?? process.env);
+    const namespace = options.namespace ?? NAMESPACE_MDA_ACTOR;
+    return uuidv5(`${deploymentId}:${id}`, namespace);
+}
+/** Integrations with per-actor toolserver subject routing enabled in this process. */
+const enabledIntegrations = new Set();
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export function enableActorSubjectIntegration(integrationId) {
+    const id = integrationId.trim();
+    if (id) {
+        enabledIntegrations.add(id);
+    }
+}
+/** True when actor-subject routing is on for `integrationId`. */
+export function isActorSubjectIntegrationEnabled(integrationId) {
+    return enabledIntegrations.has(integrationId);
+}
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export function isActorSubjectSlugEnabled(slug) {
+    const integration = integrationForSlug(slug);
+    return integration != null && enabledIntegrations.has(integration.id);
+}
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export function enabledActorSubjectIntegrations() {
+    return [...enabledIntegrations];
+}
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export function enableActorSubjectIntegrationsFromConnectors(connectorKinds, scope) {
+    if (!isUserScoped(scope)) {
+        return;
+    }
+    for (const integration of FLEET_OAUTH_INTEGRATIONS) {
+        if (hasIntegrationToolServerConnector(integration, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+    for (const integration of MARKETPLACE_MCP_INTEGRATIONS) {
+        if (hasMarketplaceConnector(integration.id, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+}
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export function enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope) {
+    if (hasIntegrationToolServerConnector(integration, connectorKinds) &&
+        isUserScoped(scope)) {
+        enableActorSubjectIntegration(integration.id);
+    }
+}
+/** Test-only reset. */
+export function resetActorSubjectEnabledForTests() {
+    enabledIntegrations.clear();
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=actor-subject.js.map

package/dist/identity/actor-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.js","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAGlD,SAAS,YAAY,CACnB,KAAuD;IAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAc1E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAO,GAA4B,EAAE;IAErC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAC5B,wBAAwB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAAC,aAAqB;IACjE,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC;QACP,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gCAAgC,CAC9C,aAAqB;IAErB,OAAO,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,WAAW,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAC1D,cAA2D,EAC3D,KAA4C;IAE5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,wBAAwB,EAAE,CAAC;QACnD,IAAI,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACnE,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACvD,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5D,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2CAA2C,CACzD,WAAkC,EAClC,cAA2D,EAC3D,KAA4C;IAE5C,IACE,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC;QAC9D,YAAY,CAAC,KAAK,CAAC,EACnB,CAAC;QACD,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,gCAAgC;IAC9C,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/byo-oauth.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import type { FleetVaultByoOauth, FleetVaultByoTokenResult } from "./fleet-connect.js";
+import { type OauthTickets } from "./oauth-tickets.js";
+import { resolveOauthRedirectBase } from "./oauth-env.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "./oauth-env.js";
+/** Shared BYO OAuth client configuration. */
+export interface ByoOauthConfig {
+    clientId: string;
+    clientSecret: string;
+    publicAppUrl: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+export interface ByoOauthEndpoints {
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    /** Space-separated default scopes when env override is absent. */
+    defaultScopes: string;
+}
+export interface ByoOauthUserInfo {
+    email?: string;
+    subject?: string;
+    /** Extra vault / provider metadata merged with {@link CreateByoOauthClientOptions.subjectMetadataKey}. */
+    metadata?: Record<string, unknown>;
+}
+export interface CreateByoOauthClientOptions {
+    /** Connect / ticket provider id, e.g. `"google"`. */
+    providerId: string;
+    /** Human label for error messages ("Google", "Microsoft"). */
+    displayName: string;
+    /**
+     * Env prefix without trailing underscore, e.g. `"GOOGLE_OAUTH"`.
+     * Reads `${prefix}_CLIENT_ID`, `_CLIENT_SECRET`, `_SCOPES`, `_AUTH_URL`,
+     * `_TOKEN_URL`, `_USERINFO_URL` unless overridden by {@link envKeys}.
+     */
+    envPrefix: string;
+    /** Override individual env key names after prefix derivation (e.g. GitHub). */
+    envKeys?: Partial<ByoOauthEnvKeys>;
+    /** Default endpoints + scopes (may read extra env, e.g. tenant). */
+    defaultEndpoints: (env: NodeJS.ProcessEnv) => ByoOauthEndpoints;
+    /**
+     * Extra authorize query params merged after the shared OAuth code-grant
+     * fields. Defaults include `prompt=consent` unless {@link defaultPrompt} is
+     * `false`.
+     */
+    authorizeParams?: Record<string, string>;
+    /**
+     * Default authorize `prompt` value. Set `false` to omit (GitHub).
+     * @default "consent"
+     */
+    defaultPrompt?: string | false;
+    /**
+     * Token exchange request shape. GitHub needs JSON + `Accept: application/json`;
+     * most IdPs use form-urlencoded.
+     */
+    tokenRequest?: {
+        format?: "form" | "json";
+        headers?: Record<string, string>;
+    };
+    /** UserInfo /profile request options. */
+    userInfoRequest?: {
+        headers?: Record<string, string>;
+        /** When true, a failed or incomplete userinfo response throws. */
+        required?: boolean;
+    };
+    /** Map a userinfo /me JSON body to email + subject (+ optional metadata). */
+    parseUserInfo: (json: Record<string, unknown>) => ByoOauthUserInfo;
+    /** Vault metadata key for the IdP subject (e.g. `google_sub`). */
+    subjectMetadataKey: string;
+}
+export interface ByoOauthEnvKeys {
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+/** BYO OAuth client produced by {@link createByoOauthClient}. */
+export interface ByoOauthClient {
+    providerId: string;
+    displayName: string;
+    env: ByoOauthEnvKeys;
+    tickets: OauthTickets;
+    resolveRedirectBase: typeof resolveOauthRedirectBase;
+    readConfig(env?: NodeJS.ProcessEnv): ByoOauthConfig | null;
+    buildAuthorizeUrl(config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string): string;
+    exchangeCode(config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<FleetVaultByoTokenResult>;
+    /** Ready for `createFleetVaultConnectProvider({ byo })`. */
+    byo: FleetVaultByoOauth;
+    resolvePublicAppUrl(env?: NodeJS.ProcessEnv): string | undefined;
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export declare function createByoOauthClient(options: CreateByoOauthClientOptions): ByoOauthClient;
+//# sourceMappingURL=byo-oauth.d.ts.map

package/dist/identity/byo-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.d.ts","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAGL,wBAAwB,EACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAExB,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAChE;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,yCAAyC;IACzC,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,kEAAkE;QAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,6EAA6E;IAC7E,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC;IACnE,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,mBAAmB,EAAE,OAAO,wBAAwB,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,4DAA4D;IAC5D,GAAG,EAAE,kBAAkB,CAAC;IACxB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CAClE;AAiBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,cAAc,CA2NhB"}